← All advisories

Critical severity9.8NVD Advisory· Published Jul 17, 2023· Updated Jun 17, 2026

CVE-2023-3696

CVE-2023-3696

Description

Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.4.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
mongoosenpm	>= 7.0.0, < 7.3.3	7.3.3
mongoosenpm	>= 6.0.0, < 6.11.3	6.11.3
mongoosenpm	< 5.13.20	5.13.20

Affected products

4

Mongoosejs/Mongoose
cpe:2.3:a:mongoosejs:mongoose:*:*:*:*:*:node.js:*:*
Range: <5.13.20
osv-coords2 versions
pkg:bitnami/mongoose pkg:npm/mongoose
< 5.13.20+ 1 more
- (no CPE)range: < 5.13.20
- (no CPE)range: >= 7.0.0, < 7.3.3
automattic/automattic/mongoosev5
Range: unspecified

Patches

Vulnerability mechanics

References

7

github.com/automattic/mongoose/commit/305ce4ff789261df7e3f6e72363d0703e025f80dnvdPatchWEB
huntr.dev/bounties/1eef5a72-f6ab-4f61-b31d-fc66f5b4b467nvdExploitPatchWEB
github.com/advisories/GHSA-9m93-w8w6-76hhghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2023-3696ghsaADVISORY
github.com/Automattic/mongoose/commit/e29578d2ec18a68aeb4717d66dd5eb66bae53de1ghsaWEB
github.com/Automattic/mongoose/commit/f1efabf350522257364aa5c2cb36e441cf08f1a2ghsaWEB
github.com/Automattic/mongoose/releases/tag/7.3.3ghsaWEB

News mentions

0

No linked articles in our index yet.